Cryptocurrencies without Proof of Work Iddo Bentov1, Ariel Gabizon2, and Alex Mizrahi3 1 Department of Computer Science, Technion, [email protected] 2 Department of Computer Science, Technion, [email protected] 3 chromaway.com, [email protected] Abstract. We study decentralized cryptocurrency protocols in which the participants do not deplete physical scarce resources. Such protocols commonly rely on Proof of Stake, i.e., on mechanisms that extend voting power to the stakeholders of the system. We offer analysis of existing protocols that have a substantial amount of popularity. We then present our novel pure Proof of Stake protocols, and argue that they help in mitigating problems that the existing protocols exhibit. 1 Introductiony The decentralized nature of Bitcoin [7, 12] means that anyone can become a \miner" at any point in time, and thus participate in the security maintenance of the Bitcoin system and be compensated for this work. The miners continuously perform Proof of Work (PoW) computations, meaning that they attempt to solve difficult computational tasks. The purpose of the PoW element in the Bitcoin system is to reach consensus regarding the ledger history, thereby synchronizing the transactions and making the users secure against double-spending attacks. The miners who carry out PoW computations can be viewed as entities who vote on blocks of transactions that the users recently broadcasted to the network, so that the decision-making power of each miner is in proportion to the amount of computational power that she has. Thus, an individual miner who has a fraction p of the total mining power can create each new block with probability p, though other factors such as “selfish mining" [1,5,6] can influence p. ≈ Under the assumption that the majority of the PoW mining power follows the Bitcoin protocol, the users can become increasingly confident that the payment transactions that they receive will not be reversed [7, 12, 15]. By means of the PoW mechanism, each miner depletes physical scarce re- sources in the form of electricity and mining equipment erosion, and thereby earns cryptographic scarce resources in the form of coins that can be spent within the Bitcoin system. Hence the following question is of interest: can a decentralized cryptocurrency system be as secure as Bitcoin even if the entities who maintain its security do not deplete physical scarce resources? y The full version of this work includes extra material such as a section on the initial issuance of the money supply, and is available at http://arxiv.org/abs/1406.5694. Cryptocurrency protocols that attempt to avoid wasting physical scarce re- sources commonly rely on Proof of Stake, i.e., on mechanisms that give the decision-making power regarding the continuation of the ledger history to enti- ties who possess coins within the system. The rationale behind Proof of Stake is that entities who hold stake in the system are well-suited to maintain its security, since their stake will diminish in value when the security of the system erodes. Therefore, in an analogous manner to Bitcoin, an individual stakeholder who possesses p fraction of the total amount of coins in circulation becomes eligible to create the next extension of the ledger with probability p. ≈ We use the terminology \pure" Proof of Stake to refer to a cryptocurrency system that relies on Proof of Stake and does not make any use of PoW. To the best of our knowledge, the idea of Proof of Stake in the context of cryptocur- rencies was first introduced in [17], though that discussion focused on non-pure Proof of Stake variants (cf. [3]). PoW based cryptocurrencies become insecure when a significant enough por- tion of the total mining power colludes in an attack. Likewise, the security of pure Proof of Stake cryptocurrencies deteriorates when enough stakeholders wish to collude in an attack. If the majority of the stake wishes to participate in at- tacks on a pure Proof of Stake system, it can be argued that there is no longer enough interest that this system should continue to exist, hence assuming that the majority of the stake will not participate in an (overt) attack is sensible. The same does not necessarily hold in a PoW based system, i.e., the majority of the mining power might be under the control of an external adversary during some time period, while the majority of the participants in this system still wish for it to remain sound. See [3] and Section3 for additional considerations. 2 Pure Proof of Stake There are two apparent hurdles with decentralized pure Proof of Stake systems: fair initial distribution of the money supply to the interested parties, and network fragility if the nodes are rational rather than altruistic. PoW offers an elegant solution to the first hurdle, by converting physical scarce resources into coins in the system. We provide here an analysis of the second hurdle in an existing pure Proof of Stake system, and also describe our novel CoA and Dense-CoA pure Proof of Stake systems that seek to mitigate this problem. Let us note this second hurdle is less severe in PoW systems, though bribe attacks on Bitcoin have indeed been considered, for example in [16]. 2.1 The PPCoin system PPCoin is a pure Proof of Stake system, in the sense that PoW is used only5 for distributing the initial money supply. Stakeholders in the PPCoin network can 5 See http://peercoin.net/assets/paper/peercoin-paper.pdf. create the next block according to the following type of condition: hash(prev blocks data; time in seconds; txoutA) ≤ d0 · coins(txoutA) · timeweight(txoutA) (*) In the inequality (*), time in seconds should correspond to the current time (with some leniency bounds), thus restricting hash attempts to 1 per second and preventing PoW use at creating the next block, because nodes will regard a new block as invalid unless the difference between its time and their local time is within the bounds. The notation coins(txoutA) refers to the amount of coins of some unspent transaction output txoutA, hence if stakeholder A has the private key skA that controls txoutA then she can create a valid block by signing the block with skA and attaching the signature as evidence that condition (*) holds. This means that a stakeholder who controls an output of e.g. 50 coins is 10 times more likely to create a block than a stakeholder who controls an output of 5 coins. See regarding timeweight(txoutA), and Section 2.1.3 regarding y prev blocks data. The constant d0 is readjusted according to a protocol rule that dictates that blocks should be created in intervals of 10 minutes on average, i.e., if fewer stakeholders are online during a certain time period then d0 gets increased. The winning blockchain is the one with the largest cumulative stake, i.e., the blockchain with the most blocks such that stake blocks are weighted according to their d0 difficulties, and PoW blocks have a negligible weight. Although the PPCoin cryptocurrency had a market cap of over $100 million in 2014, the PPCoin protocol has the following problems: 2.1.1 Rational forks 1 On every second we have that Pr[ some block is solved ] 600 , therefore mul- tiple blocks will be solved simultaneouslyf every 360000g ≈ seconds 4 days. Rational stakeholders can increase their expected≈ reward by maintaining≈ and trying to solve blocks on the multiple forked chains that were transmitted to them, which would lead to a divergent network. An individual stakeholder can either tie her hands behind her back by ignoring all the forked chains except for one, or opt to gain more rewards by keeping all the forked chains, which may render her entire stake worthless in case the network becomes divergent. The strategy of tying your hands behind your back is not a Nash equilibrium: if all the stakeholders follow this strategy then it is better for an individual stakeholder to deviate and maintain all the forked chains, as her influence on the overall convergence of the network is minor. Network propagation lag im- plies an even greater frequency of forks, as a stakeholder will get competing blocks sent to her even if those blocks were honestly solved a few seconds apart from one another. Worse still, when a rational stakeholder who currently tries to extend the block Bi receives Bi+1 from her peers, she may opt to increase her expected reward by attempting to extend both the chain :::;Bi;Bi+1 and the chain :::;Bi simultaneously. Rational stakeholders may thus prefer to reject blocks whose timestamp is later than another block that they currently try to extend, though an attempt to extend both :::;Bi;Bi+1 and :::;Bi can still be possible if the rule that the stakeholders deploy does not retrace to an earlier chain that is received late due to propagation lag. 2.1.2 Bribe attacks on PPCoin An attacker can double-spend quite easily. After the merchant waits for e.g. 6 block confirmations and sends the goods, the attacker can publicly announce her intent to create a fork that reverses the last 6 blocks, and offer bribes to stakeholders who would sign blocks of her competing branch that starts 6 blocks earlier. The attacker may offer a larger bribe to stakeholders who sign only her branch, and may commit to giving bribes even after her competing branch wins, to encourage more stakeholders to participate in the attack. Notice that the stakeholders who collude with the attacker will not lose anything in case the attack fails. As long as the value of the goods is greater than the total value of the bribes, this attack will be profitable.